Trezor Cuts Authorized Resellers After Ledger Discovers Spy Hardware in Crypto Wallets

Hardware wallet manufacturer Trezor is reducing its network of authorized resellers as concerns over supply-chain security grow following a hardware tampering incident involving rival company Ledger.

The company announced the decision on Tuesday, stating that there is no evidence its own devices have been compromised. Trezor described the move as a precaution designed to strengthen oversight of its distribution network and protect customers from potentially manipulated products.

“Following recent supply-chain incidents, we decided to reduce the number of resellers so we can more effectively check those we work with,” Trezor said in a post on X.

Trezor Chief Commercial Officer Danny Sanders also shared a letter informing affected partners that their authorization will end on January 1, 2027. The company will remove those businesses from its official reseller list on that date, although they can continue selling existing inventory through Black Friday and the holiday shopping season. No additional stock will be supplied to the affected retailers.

Sanders said the decision was not a judgment on the performance or conduct of individual partners, but reflected the company's ability to properly assess and monitor its distribution network.

Trezor has not disclosed how many resellers will lose their authorization. It said each country was evaluated separately, taking into account revenue, distribution requirements and the company's existing presence in the market. Remaining partners will face stricter requirements covering how devices are sourced, stored and handled, alongside an updated legal framework.

Ledger uncovers hidden hardware implant

The decision follows a security investigation by Ledger, which confirmed that a hardware implant had been placed inside crypto wallets sold by CryptoBilis, a third-party retailer operating in Southeast Asia.

Ledger's Donjon security team found that the unauthorized component could capture a wallet's recovery phrase by reading the device's screen. The implant then transmitted the information over an LTE mobile network using an embedded SIM card.

Recovery phrases typically consist of 24 words and provide access to the funds secured by a crypto wallet. Anyone who obtains the phrase can potentially restore the wallet on another device and transfer its assets without needing physical access to the original hardware.

According to Ledger, the implant did not modify the device's operating system or the chip responsible for storing private keys. This meant the affected wallets could appear to function normally despite the presence of the hidden component.

Ledger said all confirmed losses connected to the incident involved devices purchased through CryptoBilis. The company advised customers who bought a wallet from the retailer within the previous 90 days not to initialize it. Users who had already set up an affected device were advised to transfer their funds to a wallet secured by a new recovery phrase generated on a device purchased directly from Ledger.

Trezor said CryptoBilis had already been removed from its authorized seller list and that it had received no reports of tampered Trezor devices associated with the retailer.

Previous incidents raise supply-chain concerns

The latest measures come after earlier security incidents involving both hardware wallets and customer information.

In May 2022, Trezor warned that counterfeit Model T devices were being sold through an unauthorized seller on a Russian marketplace. The wallets had been opened and resealed, with internal components replaced. According to the company, the recovery phrases generated by the compromised devices were predictable or predefined, potentially allowing another party to access customers' funds.

Trezor advised customers to purchase wallets exclusively through its official store or authorized resellers. The company is now reducing the size of that authorized network while introducing stricter checks for the partners that remain.

More recently, a security incident involving shipping partner ShipMonk exposed customer information. Trezor reported in September that 80,689 customers were affected, while stating that its systems, hardware wallets, private keys and wallet backups remained secure.

The company has also warned customers against attempting to open suspicious devices themselves. Forcing a wallet's casing open could damage the hardware, and Trezor has cautioned that opening its Safe 7 model could pose additional risks because of its built-in battery.

The company instead advises customers with concerns about a device to contact its support team for an assessment.

With its reseller network set to shrink in 2027, Trezor is placing greater emphasis on direct oversight of how its products reach customers. The Ledger incident highlights a key security challenge for hardware wallet manufacturers: even when a device's software and internal security components remain intact, unauthorized modifications elsewhere in the supply chain can expose users to serious financial risks.